Recovering Lost Files – A How-To Guide

Goodbye, Wedding Photos: A Cautionary Tale

I’ll never forget the day I accidentally deleted the entire wedding photo folder from my NAS (Network Attached Storage) device. As I frantically scrolled through the empty directory, my heart sank. Those precious memories, captured in vivid detail, were gone – or so I thought.

You see, I’m not a storage expert by any means. I’m just a regular guy who wanted a reliable place to store all my family’s digital keepsakes. Little did I know, the solution I chose – a TrueNAS box – would one day save the day in the most unexpected way.

The Dreaded “Event”

It all started when I was tinkering around, trying to free up some space on my TrueNAS pool. I must have clicked the wrong button or entered an errant command, because the next thing I knew, an entire folder full of wedding photos had vanished into the digital ether.

As I stared at the empty directory, panic set in. My wife was going to kill me! These weren’t just any photos – they were the only copies of our special day. I had to act fast before the wedding memories were lost forever.

A Glimmer of Hope

Luckily, I had stumbled upon a Reddit thread [1] that described a similar situation and the steps taken to recover the files. The user, u/volopasse, had managed to undelete their media files after a TrueNAS mishap. I decided to give their method a try, even though I wasn’t an expert on the subject.

The first thing I did was immediately export the TrueNAS pool. This was crucial, as I needed to stop all writes to the pool in order to preserve the transaction groups (TXGs) – the building blocks that store data changes over time.

Diving into the ZFS Abyss

With the pool exported, I ran the zdb -C -e command to get a list of the disks in the pool [1]. From there, I found the disk’s partuuid, which looked something like ‘/dev/disk/by-partuuid/f044f7ba-af9b-11eb-b0a4-c86000cc24f5’.

Next, I used the zdb -l -u command to dig deeper into the disk’s Uberblocks – the metadata that describes the state of the ZFS pool at a specific point in time [1]. I scanned the output, looking for a timestamp that predated my “event.”

Turning Back the Clock

Once I identified a relevant TXG (transaction group) number, I was ready to import the pool in a read-only state using the zpool import command [1]. This would essentially rewind the pool to the state it was in before my accidental deletion.

I braced myself as the import process began. The TrueNAS documentation warned that this could take a very long time, especially for larger pools. Sure enough, my 4-disk RAIDZ1 array took a full 6 hours to complete the import!

The Moment of Truth

As the import finished, I eagerly navigated to the newly mounted pool directory, /PoolName/ instead of the usual /mnt/PoolName/. And there they were – all my wedding photos, untouched and ready to be copied to safety.

I let out a sigh of relief, quickly transferred the files to an external drive, and then exported the pool again. Finally, I imported the pool through the TrueNAS GUI, enabling snapshots to prevent future disasters.

Lessons Learned

This whole experience taught me a valuable lesson: always have a solid backup strategy in place, and familiarize yourself with the advanced features of your storage solution. If I hadn’t stumbled upon that Reddit thread [1], I might have lost those irreplaceable wedding memories forever.

But thanks to the power of ZFS and the resilience of the TrueNAS platform, I was able to recover my files and preserve the precious moments from my big day. It was a nerve-wracking journey, but in the end, the wedding photos were safely back in my possession.

So, if you ever find yourself in a similar predicament, don’t panic! With a little determination and the right tools, you can often recover lost files, even from complex storage setups like a TrueNAS pool. Just remember to act quickly, minimize any further disk activity, and don’t be afraid to dive into the technical details. Your digital memories could be just a few commands away from being restored.

Recovering Files: A Step-by-Step Guide

Preparing for Recovery

The first step in recovering lost files is to stop all write operations to the affected storage device. This is crucial to prevent the overwriting of the deleted data. If you’ve accidentally deleted files on a TrueNAS pool, like I did, the process is a bit more involved, but still very doable.

1. Export the Pool: Immediately export the TrueNAS pool to prevent any further writes. This will ensure the transaction groups (TXGs) remain intact, giving you the best chance of recovery.

2. Identify the Disks: Run the zdb -C -e <pool name> command to get a list of the disks that make up your TrueNAS pool [1]. Make a note of the disk UUIDs (Universally Unique Identifiers).

3. Find the Relevant TXG: Use the zdb -l -u '<Your Disk UUID path>' command to scan the Uberblocks (metadata) on one of the pool’s disks [1]. Look for a TXG (transaction group) timestamp that predates your data loss event.

Rewinding the Pool

Now that you’ve identified the relevant TXG, it’s time to rewind the pool to that point in time. This will allow you to access the deleted files and recover them.

1. Import the Pool: Run the zpool import -o readonly=on -T <txg> <YourPoolName> command, replacing <txg> with the TXG number you identified in the previous step [1]. This will mount the pool in a read-only state, effectively turning back the clock.

2. Wait Patiently: Depending on the size of your pool, this process can take a very long time – up to several hours in my case. Be prepared to let the import run its course.

Recovering the Files

Once the pool is imported, you should be able to navigate to the /PoolName/ directory and find your lost files.

1. Copy the Files: Locate the missing files and quickly copy them to a safe, external location. This will ensure the data is preserved, even if something goes wrong during the next steps.

2. Export the Pool: After the files are safely backed up, run zpool export <PoolName> to unmount the recovered pool.

3. Import Through the GUI: Finally, go to the TrueNAS GUI, navigate to the Storage section, and import your pool. This will mount the pool in its normal location, /mnt/PoolName/.

Choosing the Right Recovery Mode

The Windows File Recovery tool, mentioned in the Microsoft support article [2], offers two main modes for recovering lost files: Regular and Extensive. The choice between these modes depends on the file system and the circumstances of the data loss.

As a general rule, if you’re not sure which mode to use, start with Regular mode [5]. This is the standard recovery option for non-corrupted NTFS drives. If Regular mode doesn’t work, or if you’re dealing with other file systems or more complex data loss scenarios, switch to Extensive mode [6].

Wrapping Up

Recovering lost files can be a nerve-wracking experience, but with the right tools and a bit of determination, it’s often possible to restore even the most elusive digital treasures.

By following the step-by-step guide I’ve provided, and being mindful of the file system and recovery mode considerations, you too can overcome the dreaded “event” of accidental data loss. Remember, the key is to act quickly, minimize further disk activity, and don’t be afraid to dive into the technical details.

So, the next time you find yourself staring at an empty folder, wondering where your precious files have gone, take a deep breath and get ready to pull off a digital data heist. With a little luck and a lot of grit, you just might be able to turn back the clock and recover those lost memories.

[1] Knowledge from https://www.reddit.com/r/truenas/comments/189n98e/guide_how_to_undelete_files_or_recover_changed/
[2] Knowledge from https://support.microsoft.com/en-us/windows/recover-lost-files-on-windows-10-61f5b28a-f5b8-3cc2-0f8e-a63cb4e1d4c4
[3] Knowledge from https://groups.google.com/g/sessionbuddy-discuss/c/JB4s5PpdIss
[4] Knowledge from https://www.forbes.com/advisor/business/software/how-to-recover-deleted-files/
[5] Knowledge from https://steamcommunity.com/app/250900/discussions/0/4030221636412365387/
[6] Knowledge from https://forums.androidcentral.com/threads/guide-recovering-deleted-files.500142/
[7] Knowledge from https://communities.sas.com/t5/SAS-Procedures/How-to-recover-unsaved-codes/td-p/59053
[8] Knowledge from https://www.acronis.com/en-us/blog/posts/how-to-recover-deleted-files-on-windows-11/